The Advanced Woo Search plugin for WooCommerce versions up to 2.96 suffers from a reflected XSS vulnerability (CWE-79) via the search parameter due to inadequate input sanitization and output escaping. This vulnerability is exploitable only when the Dynamic Content for Elementor plugin is also installed on the site. An attacker can inject arbitrary web scripts that execute in the context of the victim's browser if the victim clicks a malicious link. The vulnerability requires no privileges but does require user interaction (clicking a link).

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other actions permitted by the victim's privileges. The vulnerability does not affect availability and requires user interaction. It is limited to sites using both Advanced Woo Search and the Dynamic Content for Elementor plugin.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider disabling the Advanced Woo Search plugin or the Dynamic Content for Elementor plugin to mitigate risk. Avoid clicking on suspicious links that could exploit this vulnerability.